Question

通过使用Spring安全性，当我将应用程序Web打开一段时间后，身份验证将丢失，用户必须再次登录，因此当我单击应用程序中的按钮或链接以完成我的工作时，会出现此异常：

Etat HTTP 500 - javax.servlet.ServletException: javax.servlet.jsp.JspException: org.springframework.beans.NotReadablePropertyException: Invalid property 'principal.username' of bean class [org.springframework.security.authentication.AnonymousAuthenticationToken]: Bean property 'principal.username' is not readable or has an invalid getter method: Does the return type of the getter match the parameter type of the setter?

所以我想隐藏这个，并显示一个漂亮的页面说用户必须登录，因为用户可能不理解tomcat的消息，他可能会吓到！有什么建议吗？

/ *编辑* /

    <?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
        xmlns:beans="http://www.springframework.org/schema/beans" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security-3.0.xsd">

        <http auto-config="true">
            <intercept-url pattern="/" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/index*" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/mise_a_jour*" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/recherche*" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/pages/*" filters="none" />
            <intercept-url pattern="/css/*" filters="none" />
            <intercept-url pattern="/js/*" filters="none" />
            <intercept-url pattern="/images/*" filters="none" />
            <form-login login-page="/login" authentication-failure-url="/failLogin" />
            <logout logout-success-url="/logoff" />
            <access-denied-handler error-page="/403" />

        </http>



   <beans:bean id="concurrencyFilter"
          class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <beans:property name="sessionRegistry" ref="sessionRegistry" />
        <beans:property  name="expiredUrl" value="/session-expired"  />
      </beans:bean>

        <authentication-manager>
            <authentication-provider>
                <password-encoder hash="sha" />
                <jdbc-user-service data-source-ref="dataSource"
                    users-by-username-query="select login,password, enable from utilisateurs where login=?"
                    authorities-by-username-query="select u.login, r.role from utilisateurs u, roles r where u.id = r.id and u.login =?  " />
            </authentication-provider>
        </authentication-manager>


    </beans:beans>

堆栈跟踪：

Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'sessionRegistry' is defined
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:527)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedLocalBeanDefinition(AbstractBeanFactory.java:1083)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:274)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:190)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:322)
    ... 25 more

Answer 1

你可以设置一个名为expired-url的配置，类似这样的

<beans:bean id="concurrencyFilter"
      class="org.springframework.security.web.session.ConcurrentSessionFilter">
    <beans:property name="sessionRegistry" ref="sessionRegistry" />
    <beans:property **name="expiredUrl" value="/session-expired.htm"** />
  </beans:bean>

此处提供更多信息http://static.springsource.org/spring-security/site/docs/3.0.x/reference/session-mgmt.html。

处理会话过期的异常

1 个答案: